A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport

libreport is the Red Hat / Fedora crash-reporting library that backs ABRT. When a process crashes, ABRT runs *post-create event handler scripts* that scrape the systemd journal for log lines tagged with the crashing PID, then write those lines into the dump directory as root. The bug: the handler doesn't sanitize control characters (notably embedded newlines) when copying journal text into files. A local unprivileged user who can write to the journal — i.e., any logged-in user, because logger(1) and sd_journal_send() are world-accessible — can craft syslog messages that, when concatenated by ABRT, look like multi-line entries the dump tooling parses as legitimate fields. The flaw lives alongside three sibling CVEs (CVE-2026-54228 through 54230) covering TOCTOU and symlink-following in the same post-create scripts.

Affected packages are libreport and abrt as shipped in RHEL 8 / 9 / 10, Fedora 40+, and downstreams (CentOS Stream, Rocky, Alma, Oracle Linux). The vendor's MEDIUM / 5.5 rating reflects the local-only attack vector and integrity-only impact (C:N/I:H/A:N) — and that's actually a *fair* read. Calling it MEDIUM nudges it above real risk on a single-admin server; the integrity impact is real but bounded to dump-directory file contents, not arbitrary code execution. We're knocking it one bucket down to LOW because in the dominant deployment role (single-admin server, no untrusted local users) there is no attacker positioned to exploit it.

Why this verdict

• Local + authenticated requirement strips the entire unauthenticated internet attacker population. No external scanner finding will ever flag this on a perimeter host.
• Integrity-only impact (C:N/I:H/A:N) means the attacker can forge log content but cannot read secrets or take the system down. The chain ends at 'misleading log file', not 'shell as root'.
• Role multiplier — typical Linux server (line-of-business app tier, no interactive users): chain fails at step 1, no impact.
• Role multiplier — shared multi-user host (university HPC, jump boxes, dev sandboxes, CI runners with per-job user accounts): chain succeeds, but blast radius is limited to forged dump content on a single host. Worth treating as MEDIUM in this role; LOW overall because this role is <15% of typical enterprise Linux fleets.
• Role multiplier — container hosts / immutable images: ABRT usually not installed or disabled; chain fails at step 1.
• EPSS 0.00122 + no KEV + no PoC weaponization confirms the practitioner consensus that this is not a priority bug.
• The dangerous siblings (54228-54230) drive the patch decision — you'll ship the errata for those anyway, and 54231 rides along for free.

Why not higher?

MEDIUM would imply a credible path to confidentiality loss or code execution, or a deployment role where ≥10% of installs are exposed to local-untrusted-user attackers. Neither holds: impact is integrity-only on a dump dir, and the multi-user-host population is a minority of fleet. Going to HIGH would require a chained RCE primitive, which is what siblings 54228/54229/54230 provide — not this CVE.

Why not lower?

IGNORE would be wrong because the sibling-CVE patch bundle gives you no choice but to deploy the fix anyway, and on shared multi-user hosts the integrity-forgery primitive can meaningfully degrade incident-response evidence quality. LOW captures 'patch it on the normal cadence with the rest of the errata; don't lose sleep'.

1. Disable ABRT auto-collection on hosts with no operator need for it — systemctl disable --now abrtd abrt-journal-core abrt-oops abrt-xorg. Removes the post-create script from the execution path entirely. On most production application servers, ABRT is dead weight. No mitigation SLA applies to LOW — fold this into the normal hardening baseline review.
2. Remove libreport/abrt from server images that don't need crash reporting — dnf remove abrt abrt-libs libreport libreport-plugin-systemd-journal. This is the cleanest fix and removes the attack surface for all four 54228-54231 CVEs at once.
3. Restrict interactive shell on application-tier hosts — The CVE is unreachable without a local low-priv user. Audit /etc/passwd for accounts with valid shells beyond root/operators, and lock them. This is good hygiene independent of this CVE.
4. Ship the next routine errata bundle that includes RHSA fixes for 54228-54231 — Since 54231 is bundled with the more serious 54228-54230 (LPE-to-root via TOCTOU/symlink), normal monthly patching closes this for free. Treat the bundle as HIGH because of the siblings, not because of 54231.

Run on each RHEL/Fedora target host as a non-privileged user (root not required for the version check). Example invocation: bash check-cve-2026-54231.sh. Exits 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN. The fixed-version comparison covers the canonical Red Hat and Fedora streams; adjust the FIXED map for your downstream (Oracle, Rocky, Alma) if you backport differently.

#!/usr/bin/env bash
# check-cve-2026-54231.sh — libreport ABRT post-create content injection
# Output: VULNERABLE / PATCHED / UNKNOWN
set -u

result="UNKNOWN"
reason=""

# Step 1: is libreport even installed?
if ! command -v rpm >/dev/null 2>&1; then
  echo "UNKNOWN: rpm not available — not an RPM-based distro"
  exit 2
fi

if ! rpm -q libreport >/dev/null 2>&1; then
  echo "PATCHED: libreport package not installed (attack surface absent)"
  exit 0
fi

# Step 2: is abrt installed and enabled? if not, exposure is moot
abrt_active="no"
if systemctl is-enabled --quiet abrtd 2>/dev/null || systemctl is-active --quiet abrtd 2>/dev/null; then
  abrt_active="yes"
fi

# Step 3: NEVRA comparison against known-fixed versions per stream
# Update the FIXED_* values as Red Hat publishes errata-stream backports.
installed_nevra=$(rpm -q --qf '%{EPOCH}:%{VERSION}-%{RELEASE}\n' libreport | head -1)
installed_ver=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' libreport | head -1)
os_id=$(. /etc/os-release && echo "${ID}-${VERSION_ID%%.*}")

case "$os_id" in
  rhel-8|centos-8|rocky-8|almalinux-8|ol-8)
    FIXED="2.9.5-15.el8_10" ;;
  rhel-9|centos-9|rocky-9|almalinux-9|ol-9)
    FIXED="2.15.2-7.el9_4" ;;
  rhel-10|centos-10|rocky-10|almalinux-10|ol-10)
    FIXED="2.17.0-3.el10" ;;
  fedora-40|fedora-41|fedora-42)
    FIXED="2.17.1-1.fc40" ;;
  *)
    echo "UNKNOWN: unrecognized distro stream '$os_id' — verify errata manually"
    exit 2 ;;
esac

# rpm -E '%{lua: ... }' would be cleaner; use rpmdev-vercmp if available, else fallback
if command -v rpmdev-vercmp >/dev/null 2>&1; then
  rpmdev-vercmp "$installed_ver" "$FIXED" >/dev/null 2>&1
  cmp=$?  # 0 equal, 11 first newer, 12 second newer
  if [ "$cmp" -eq 0 ] || [ "$cmp" -eq 11 ]; then
    result="PATCHED"
    reason="libreport $installed_ver >= fixed $FIXED for $os_id"
  else
    result="VULNERABLE"
    reason="libreport $installed_ver < fixed $FIXED for $os_id; abrtd_active=$abrt_active"
  fi
else
  # crude fallback: string compare; flag UNKNOWN if uncertain
  if [ "$installed_ver" = "$FIXED" ]; then
    result="PATCHED"
    reason="libreport $installed_ver matches fixed $FIXED"
  else
    result="UNKNOWN"
    reason="install rpmdevtools for accurate vercmp; installed=$installed_ver fixed=$FIXED"
  fi
fi

echo "$result: $reason"
case "$result" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. Red Hat CVE-2026-54231 advisory page
2. GHSA-p464-2mqm-5h37 (GitHub Security Advisory)
3. Vulnerability-Lookup CIRCL entry
4. THREATINT CVE record
5. TheHackerWire entry
6. Threat-Modeling.com Vulnerability Intelligence Report (2026-06-14)
7. abrt/libreport upstream repository
8. NVD entry (when published)